Splunk Search

How to select specific fields conditionally based on user input for a drilldown search?

masumbuet
New Member

Hi,
I want to select fields conditionally based on user input. It is a drilldown search. I want to show specific fields based on the user click.

For example, I have the following fields:
Server Name
OS Version
OS Name
DB Name
DB Version

The main table contains OS, DB. If the user clicks OS, I need to show only the "OS Name", "OS Version" fields. How can I achieve this?

Your held is highly appreciated. Thanks in advance.

Tags (3)
0 Karma

ngatchasandra
Builder

If your main table contains OS and DB, this means that you have written a specific static request for this table that is going to displays only the OS and DB. Then, if you want this table change when you selected only OS, is not possible because your request is configured to displays always OS and DB.
We know that drilldown is launch when you click a value which is going to replace a token corresponding who is configured in search drilldown.
Thus, to do your work, you need to add other search (in other panel) which is going to interact with user input (dropdown input for example) then the click like this:
Index=”…..” OS= $OS$ | table “OS Name” “OS Version”

Dropown input can displays like this:

<input type="dropdown" token="OS" searchWhenChanged="true">
      <choice value="*">All</choice>
<populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="OS" fieldForValue="OS"> index=”…” | stats count by OS 
</populatingSearch
      <default>*</default>
      <prefix>OS="</prefix>
      <suffix>"</suffix>
    </input>
0 Karma
Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...